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We analyse security costs in one segment of nested purification protocol in a large quantum 
cryptography network, employing the quantum switchers and repeaters. We demonstrate that 
exponential or even super-exponential grow of entanglement resources occurs in dependence on 
number of the network switchers. For this reason, an optimization in the nested strategy is suggested, 
preventing a stronger than the exponential grow of entanglement resources. 
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Recently, quantum cryptography link using entangled 
states [Q, g] has been experimentally realized ||, which 
is basic step to futured quantum cryptographic network. 
To construct this network, original Ekert's protocol has 
been extended by the quantum memories Q and quan- 
tum switchers [|] . Quantum memories carefully store the 
entangled states before key distribution and the quan- 
tum switchers are able to swap entanglement and con- 
sequently, establish a secret communication between dis- 
tant users. However, the entangled states transmitted be- 
tween the users or stored in the quantum memories can- 
not be precisely protected against undesirable decoher- 
ence or the deliberate eavesdropper attacks. Due to these 
influences, the entanglement exponentially vanishes with 
increasing distance between the users. Fortunately, quan- 
tum cryptography based on Ekert's protocol presents a 
potential advantage, since the users could regenerate the 
secure key by implementing a purification protocol Q . 
Quantum purification is able to extract sufficiently en- 
tangled pair of photons from a number of the pairs with 
weak entanglement, utilizing only the local operations 
and classical communications. Thus, the links between 
users in the networks achieve a sufficient security and 
the almost maximally entangled pairs can be stored in 
the quantum memories for the next usages. 

Practical implementation of the swapping/purification 
idea based on the quantum repeaters in connection points 
of network extended standard purification to nested pu- 
rification protocol (NPP) ||, |{|. We can assume a link 
consisting of total number N — 1 of the switchers con- 
necting N pairs of imperfectly entangled states, having 
non-unit fidelity with maximally entangled state. On the 
first level, we implement the quantum repeaters in the 
check points with L switchers between two repeaters. To 
purify one pair with required amount of entanglement 
between nearest repeaters, we need a certain number M 
of copies that we construct in parallel fashion, as is de- 
picted in Fig. 1. The total number of elementary pairs 
is M(L + 1). On the second level, we repeat this pro- 
cedure considering the outcomes of first level as input 
pairs for second level. In summary, the total number of 
elementary pairs will be B 

which shows that the resources grow polynomially with 



the distance N. However, the number of needed entan- 
gled pairs M per segment and per one nesting level de- 
pends on number of switchers L, on fidelity of pairs be- 
tween the nearest users and required fidelity of outgoing 
pairs between the distant users. To simplify discussion, 
we require the same value of a long-distance fidelity as 
the nearest users fidelity and denote it as "working" fi- 
delity. It has been previously shown |8[ |jj that for L = 2, 
the optimal "working" fidelity F w 0.95 requires mini- 
mal number of four pairs per segment and nesting level. 
However, if we want to create entanglement over arbi- 
trary distance (large L), there is still a question, how 
much weakly entangled pairs are needed between two re- 
peaters for purification up to working fidelity. Shortly, 
what is the relation M — M(L, F) in the nested purifi- 
cation protocol? 

In this paper, we present an analysis of these security 
costs, assuming an almost perfect entanglement between 
the users in the neighbourhood. To distribute entangle- 
ment between the distant users in cryptographic network, 
an idealized swapping/purification protocol will be as- 
sumed. These procedures can be implemented probabilis- 
tically, with the help of only linear optics elements [0 . 
We demonstrate a new and important fact, that the num- 
ber of imperfectly entangled states between two quantum 
repeaters grows exponentially or even super- exponentially 
with the number of implemented switchers. It is a cost 
of exponential decoherence elimination, which must be 
paid to achieve a secure key distribution. For this rea- 
son, we suggest an optimized nested purification protocol 
(ONPP), which prevents the super-exponential grow of 
the security costs. It will be important for a construction 
of the quantum cryptographic network, expected in the 
next future. 

Now we will theoretically discuss both the entangle- 
ment swapping and distillation procedures in one seg- 
ment of nested purification protocol, as is depicted in 
Fig. 1. We assume that the nearest users = i + 1) 
share two-qubit state 
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which is given in the Bell basis 
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Note that diagonal elements Bk,k = (Bk\p\Bk) are the 



fidelities Bk with particular Bell states (H). First, we dis- 
cuss a propagation of entanglement in the network utiliz- 
ing the standard entanglement swapping between two 
links + and (i + l,i + 2). Assuming Bell state anal- 
yser, which, at least conditionally, distinguishes between 
four Bell states (||), the diagonal elements Bk t k = Bk 
change along rule 
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independently on the off-diagonal elements. If the swap- 
ping procedure is carried out many times with an en- 
semble of pairs distributed along the link, the iterative 
rule (^) describes the evolution of fidelities in the link 
with the switchers. However, the entanglement swap- 
ping of weakly entangled states leads to generation of 
lower entangled pair at a large distance. To improve 
this long-distance entanglement, we can use LOCC pu- 
rification procedure J?| requiring multiple copies of the 
long-distance states. Deutsch's purification allows us to 
distill a state with needed amount of entanglement from 
M imperfectly entangled pairs p(°> i+1 ) having fidelity 
Bi > 1/2. It is composed from three steps: (i) the local 
unitary operations on the sender side 



|0)--^(|0)-i|l)), 11)-;^ 
and on the receiver side 

|0)--L(|0) + *|1)), 11} 
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followed by (ii) action of the quantum C-NOT operation 
on the both sides 



\a)c\b) T -> |o)c|aS6>G 



where C is control qubit and T is target qubit, and (iii) 
measurement of the target qubits on the both sides. If 
the measurement outcomes coincide, the control pair is 
kept for next round. For two different states p(°' L + 1 ) and 
p '(o.L+i) described by fidelities B % and B' i: the distilled 
pair has the following shifted fidelities 
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^Bi+B'M B 2 = -(B 1 B / 4 + B' i B 1 ), 
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where N = (B x + B 4 )(B[ + Bfi + (B 2 +_B 3 )(B' 2 + B 3 ), 
Bi, BI are the fidelities of input pairs and Bi are the fideli- 
ties of an output distilled pair. Particularly, if B\ > 1/2 
for all shared states, there is only one fixed point for 
B\ = 1 Q. After some steps of procedure, the out- 
going state is sufficiently close to this fixed point (as it 
is necessary) and the sender and receiver establish a re- 
source for key distribution with a given security. After 
m repetition of purification procedure, we can generate 
a strongly entangled pair from 2 m input lower entangled 
pairs. In this way, an eavesdropping attack is factorized 
from the sender-receiver state. On the other hand, if 
the purification procedure does not converge, we cannot 
use the outcoming pairs for the key distribution. Thus, 
a convergence of the procedure must be simultaneously 
proved in the communication. Note, when there are the 
imperfect local operations, only a maximal non-unit fi- 
delity is obtained, however as has been recently proved, 
the users may nevertheless use these pairs for secure com- 
munication [ fTo| . 

The iterative procedures (^) and (g) represent a com- 
plete solution of the presented problem for any two-qubit 
states. To discuss the security costs in dependence on the 
number of switchers, we will analyse two interesting cases 
of the decoherence process. As first, we will analyse the 
security costs in the network with the states p( l > z+1 ) after 
an optimal individual eavesdropping attack - quantum 
nondemolition (QND) measurement. We assume that 
state \Bi) is decohered by the standard QND monitoring 
of basis states |0) and |1) 
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where R is a measure of robustness against decoherence 
and \0) E and 1 1) E are basis states of the environment. Af- 
ter monitoring process and tracing out the environmental 
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states, we obtain input states for swapping procedure 

p (M+D = Bl \Bi)(Bi\ + (1 - B 1 )\B 2 ){B 2 \ (10) 

where Bi = |(1 + R) is fidelity determined by the ro- 
bustness. Note, that state ( |To| ) is entangled and nonlocal 
for every R > 0. During swapping procedure (^J), the 
structure of state ( |Tc| ) is preserved and only the fidelity 
B\ changes according to 
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This rule can be iterated to obtain an outgoing state 
from swapping procedure. Employing robustness param- 
eter R, we can simply find that outgoing robustness is 
R! = R L , which is signature of pronounced exponential 
decoherence. After swapping procedure (fill), the result- 
ing state is considered as the input of Deutsch's purifica- 
tion procedure for F — B\ 
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which can be simplified for the same states utilizing the 
robustness R = 2/2/ (1 + R 2 ). Introducing two new pa- 
rameters r and r' , R = tanhr and R = tanhf, we have 
f = 2 m r = Mr, after to levels of the purification pro- 
cedure. Due to this relation, we can express a relation 
between near-users robustness R and the long-distance 
robustness in form of R = tanh(Marctanhi2 ) and ap- 
proximately determine a lower bound on M as 

Vln(l + i? L )-ln(l-i2 L )/ V ; 

If R > 0, then purification procedure converges to fixed 
point B\ — 1 for every L, however the number of 
needed entangled states exponentially increases, as is de- 
picted in Fig. 2 for almost maximal "working" fidelities 
B x = 0.9925,0.985,0.9625. This exponential overhead 
is necessary cost that must be paid to establish a secu- 
rity of quantum channel at a large distance. It is still 
opened question, whether the LOCC purification proce- 
dure can be modified in such a way to obtain only a 
sub-exponential overhead. 

As a second example, we consider Werner state be- 
tween the nearest users. Note, that Werner state results 
from the simplest eavesdropping strategy on the state 
\B\): Eve steals the photon transmitted from sender sta- 
tion with probability p and subsequently, sends another 
photon with random polarization towards receiver sta- 
tion. Particularly, for the L switchers with the L + 1 
Werner states (having B 2 = B% = B4) 



pW)= J ,| J B 1 )( J B 1 | + i-^l®l 1 
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where p = {ABi — l)/3, an outgoing state is the Werner 
state ( |l4| ) with p' — p L . This is a signature a exponential 



decrease of nonlocality and entanglement in a network 
with large L, even if particular p approaches unity. Note, 
that Werner state ( |l4| ) is entangled if the entanglement 
factor A = 1/2(1 — 3p) is negative and does not admit a 
local realistic explanation if the Bell factor B max = 2V%p 
is larger than 2. After L swapping procedures, we obtain 
a long distance Werner state with the following fidelity 
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which is entangled if and only if B[ > i. Then if is 
possible to use the purification procedure, i.e. numer- 
ically iterate the map (||). Number M = 2 m (where 
to is the number of purification steps) of pairs needed 
to achieve the same fidelity, as has been between the 
nearest users, is depicted in Fig. 3 in dependence on the 
number L of the switchers for the "working" fidelities 
B x = 0.9925,0.985,0.9625. As can be seen, we have two 
distinct regions of overhead: for given B\, the number 
M firstly exponentially grows with L and this divergence 
changes to rapid super- exponential behavior. Note, that 
super-exponential overhead is pronounced as the fidelity 
B\ approaches unity. For sufficiently large B\ > 0.95, 
we can optimize NPP to prevent super-exponential over- 
head, if we restrict the number L of switchers between 
two repeaters 



L < 



1 



2 1- 



ln(4Bi 



In 3 



(16) 



to half of the maximal value L max , where L max is de- 
picted in Fig. 2 by a cross symbol. In addition, it can 
be numerically checked that the analysed case, employ- 
ing the Werner states, is the most expensive from all the 
cases with the same state (Q) between the nearest users. 
Because we are not able to priori know what are the 
states distributed between nearest users, the restriction 
( |l6| ) is a general way how to prevent super-exponential 
overhead and it represents optimized nested purification 
protocol (ONPP). 

In summary, irrespective to very encouraging experi- 
mental results in entangled state cryptography [gj, en- 
tanglement swapping procedure g , a strong exponential 
decoherence arises at a large distance from "multiplica- 
tion" of small deviations from perfect near-users entan- 
gled states. To avoid this decoherence, we can use the 
nested purification procedure [|| In this paper, we 
have found a general formula for the fidelity evolution in 
this nested purification procedure and we have demon- 
strated that, per nesting segment, this procedure exhibits 
exponential or even super- exponential overhead in the en- 
tanglement resources, in dependence on the number of 
the entanglement switchers. We analysed the case with 
a maximal overhead and optimized NPP by a restriction 
of maximal number of switchers between two repeaters 
to avoid super- exponential overhead. It is important for 
any construction of the sufficiently secure large crypto- 
graphic networks in the next future. However, there is 
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a still opened question whether it is possible to obtain 
a sub-exponential overhead by a modification of swap- 
ping/purification procedure. 
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FIG. 1: Segment of nested purification protocol: R- quan- 
tum repeaters, S- switchers based on entanglement swapping 
employed by particular users. 



FIG. 2: Number of entangled pairs M = 2 m needed for dis- 
tillation of one entangled pair between distant users with 
the same security as for the nearest users, L number of 
the switchers in the link mutually sharing the same QND 
states with given R: (a) R=0.985 (Bi = 0.9925), (b) R=0.97 
(Si = 0.9850), (c) R=0.925 (Si = 0.9625). 



FIG. 3: Number of entangled pairs M = 2 m needed for dis- 
tillation of one entangled pair between distant users with the 
same security as for the nearest users, L number of the switch- 
ers in the link muttually sharing the same Werner states with 
given p: (a) p=0.99 (Bi = 0.9925), (b) p=0.98 (Si = 0.9850), 
(c) p=0.95 (Bi — 0.9625). The crosses denote a threshold 
number L max of the switchers between two repeaters. 



